banking.jpg

Banking Malware steals millions of dollars from both personal and business accounts in the United States every year. Personal accounts are insured by federal banking regulations, but businesses are less protected.

We have had several individual targets to protect from various malwares for a while now and today we are happy to announce that we have added new compound targets, which group all of the various banking specific malwares so that you can add them to your policies.

Banking Malware domains - This RPZ target lists Banking Malware domains including:

  • Tiny Banker Trojan (also: Tinba) is a malware program that targets financial institution websites. It is a modified form of an older form of viruses known as Banker Trojans, yet it is much smaller in size and more powerful. It works by establishing man-in-the-browser attacks and network sniffing. Tinbas infrastructure, among others, was taken down during the Avalanche network takedown on November 30th Having this list in your policy will allow you to see infections by the malware which needs to be clean up, but they are not a threat to your network.
  • Necurs is widely believed to be one of the largest botnets (with 6.1 million functioning bots) and is responsible for millions of dollars in losses tied to ransomware and Dridex banking Trojan infections.
  • Fobber is an information-stealing Trojan that focuses on online activity. Fobber grabs the passwords to your valuable accounts, primarily targeting the banking accounts. Fobber intercepts any information that you type on the financial platforms. This data is then encrypted and sent to the C&C servers.
  • Dyre attempts to steal sensitive user information, particularly banking information, by intercepting this information when it is passed between your web browser and the target website. This malware is often distributed in scam type phishing emails that ask the user to download a ZIP file. Dyre has the ability to bypass certain online security solutions like SSL and two-factor authentication.
  • Banjori (also: MultiBanker 2 or BankPatch/BackPatcher) steals personal information, such as your user names and passwords. It sends the stolen information to a C&C servers.
  • ZeuS is used to steal banking information by man-in-the-browser keystroke logging and form grabbing.
  • Feodo (also known as Cridex or Bugat) and its successor Dridex are Trojans used to commit ebanking fraud and steal sensitive information from the victim’s computer, such as credit card details or credentials.
  • Shifu uses tactics, techniques and procedures from multiple malware families including Shiz, Zeus and Dridex to steal user information.
  • This Target also includes our new manual list TSBanking domains, which will include domains that the ThreatSTOP security team has determined are current and active Banking Threats. This target is also available by itself in expert mode.

Banking Malware IPs – This IP Target lists Banking Malware IP addresses including:

  • ZeuS is used to steal banking information by man-in-the-browser keystroke logging and form grabbing.
  • Feodo (also known as Cridex or Bugat) and its successor Dridex are Trojans used to commit ebanking fraud and steal sensitive information from the victim’s computer, such as credit card details or credentials.
  • This Target also includes our new manual list TSBanking IPs, which will include IP addresses that the ThreatSTOP security team has determined are current and active Banking Threats. This target is also available by itself in expert mode.

We will keep adding more malware banking families to these targets as we get the feeds and will keep protecting you all the time.

All of our IP targets are available for both IP and DNS Firewall clients.

Our RPZ targets are only available to the DNS Firewall customers – if you do not have a DNS Firewall, it’s time to upgrade. Contact us at 1-855-958-7867 or success@threatstop.com